MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The sample is an OLE document with a significant amount of slack space, indicating potential obfuscation or embedded malicious content. A critical heuristic firing for XOR-encoded strings suggests that malicious code is present and hidden. The document's purpose is likely to exploit a client-side vulnerability to execute arbitrary code.
Heuristics 2
-
XOR-encoded strings (key 0x63) critical SC_XOR_ENCODEDFound 4 Windows library/API name(s) XOR-encoded with single-byte key 0x63: 'LoadLibraryA', 'CreateProcessA', 'ExitProcess ', 'CreateFileA '
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 201,859 bytes but its declared streams total only 20,635 bytes — 181,224 bytes (90%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.